MSP cybersecurity is the security work a managed service provider runs for its clients and for its own business. For a small MSP, that means a written baseline (MFA, patching, tested backups, endpoint and email protection, training, incident response), sold per user, with 24/7 monitoring handed to a specialist.
This guide comes from the team behind SherpaDesk, a helpdesk and professional services automation (PSA) tool a small IT team can run alone.
Key takeaways
In this series · Running a small MSP
It has two sides: the security service you run for clients, and the security of your own business.
Your access to every client makes a cybersecurity MSP a target. CISA's performance goals warn that "adversaries can exploit vulnerabilities by abusing trusted third-party relationships."
Verizon's 2026 Data Breach Investigations Report analyzed more than 22,000 breaches across 145 countries.
CISA's Cybersecurity Performance Goals 2.0 add a goal on MSP risk. It asks clients to "proactively address any security gaps that fall outside the scope of the contract."
Start with these ten controls drawn from CISA's CPG 2.0 goals. Adapt them to the client's risks.
| Control | What you run | Owner and cadence | Evidence for the client |
|---|---|---|---|
| MFA | MFA wherever supported, admin accounts first | Your tech; monthly check | Accounts without MFA, and why |
| Patching | A due date per patch, known-exploited flaws first | Your tech; weekly review | Open patches by age and due date |
| Asset inventory | A current list of hardware, software, and data | Your tech; monthly | Hardware, software, and data inventories with owners |
| Endpoint protection | Signature and behavior-based malware detection | Your tech; weekly review | Devices without an active agent |
| Email authentication | SPF, DKIM, and DMARC at "reject" once senders are verified | Your tech; at setup, then quarterly | The DMARC policy for each domain |
| Inbound email filtering | Malware scanning of incoming mail | Your tech; weekly review | What was blocked or released |
| Backups | Offsite and offline copies, recovery tested at least yearly | Your tech; daily job check | The last restore test record |
| Training | Training before system access, then at least yearly | Client manager; yearly | Completion, plus a reset-request drill for techs |
| Access and offboarding | Least privilege, 16+ character passwords, access revoked on exit | You and the client; quarterly | Accounts reviewed and disabled |
| Incident response plan | A written plan, exercised regularly | You and the client; yearly exercise | The plan and the last exercise date |
Triage urgent alerts, such as malware detections or a failed backup, within the response window agreed with the client; NIST says to estimate each incident's severity and urgency. The weekly review covers unresolved work only.
Give each patch a due date from exploitation risk, exposure, and how important the system is. CISA says to use its Known Exploited Vulnerabilities catalog to prioritize, and internet-facing systems go first. Review overdue patches every week. When something can't be fixed, record the exception, the compensating control, and a review date. The work closes when the next scan or report shows it fixed.
Roll out MFA in order: enroll a client admin, test the recovery access, then move users over. Log apps that can't do MFA as dated exceptions.
Before DMARC goes to "reject," list every service that sends mail as the client's domain; the UK's NCSC tightens policy once SPF and DKIM cover them. DMARC doesn't replace filtering for malicious links and attachments.
A disaster recovery plan is the written procedure for restoring a client's critical systems after an outage or attack. CISA's backup goal asks for copies stored "offsite and offline," recovery tested "no less than once per year," and integrity checked before any restore. Set test frequency from the client's recovery targets.
The recovery time objective (RTO) is how long a system can stay down "before negatively impacting the organization's mission." The recovery point objective (RPO) is how much data the client can afford to lose, and it sets how often you back up.
Rank what the client can't work without, and agree an RTO and RPO for each. Back up license keys and configurations too.
Write down who starts the plan, who calls whom, and a backup channel if email is down.
Each sheet names a lead, the restore order, and vendor contacts.
Name where it is: a printed copy at the client's office and one with your on-call tech. CISA's recovery goal plans for losing internet access.
Record the recovery time and the age of the recovered data, whether each met the RTO and RPO, and whether the app works. Then book the next test. After a test or an incident, run a post-incident review.
Common mistake: counting "the backup job succeeded" as a restore test.
CISA asks organizations to "regularly engage third-party cybersecurity experts" for tests such as penetration tests and tabletop exercises, then fix what they find. NIST describes a penetration test as testing in which "evaluators mimic real-world attacks" to find ways around a system's security.
| Test | What it answers | Who runs it |
|---|---|---|
| Vulnerability scan | Which known weaknesses are exposed right now? | You, on a schedule |
| Penetration test | Can an attacker chain weaknesses and get in? | A qualified third party |
| Tabletop exercise | Does the team know the incident plan? | You and the client, with a scenario |
Scans and penetration tests both need written permission and an agreed scope. Ethical hackers also need a way to reach you. CISA asks for a public way to report vulnerabilities and names a security.txt file (RFC 9116) as a common method. Name who reads the reports and who follows up. Publishing it doesn't grant permission to test.
Subscribe to the SherpaDesk Blog.
Get Tips for Running IT With a Small Team.
Loading form…
The form couldn’t load. Please try again.
Or start your free trial →SHERPADESK · FREE TRIAL
Resolve tickets.
Turn time into revenue.
Bring support tickets, billable time, and invoicing into one place. Built for small IT teams and MSPs.
After your trial, keep your first agent free forever.
SHERPADESK · LIVE DEMO
See tickets, time,
and billing work together.
Walk through ticketing, time tracking, and billing with a product specialist. See how SherpaDesk fits the way your team works.
A live walkthrough tailored to your team.
Your helpdesk is a security risk because your techs reset passwords for client users. A CISA and FBI advisory describes attackers who "posed as employees to convince IT and/or helpdesk staff" to reset passwords and move MFA to a device the attacker controls. Our Ticket Trick post shows another inbox risk.
Write a routine and check it:
In a 2026 Center for Internet Security survey of 426 K-12 cybersecurity and tech leaders, 51% of schools and districts reported a cyber incident in the past year. For a cybersecurity MSP that serves districts, the baseline applies, with three school decisions:
Public districts may qualify for CISA's no-cost scanning, open to state and local governments and critical infrastructure organizations.
Put the baseline in every managed services agreement. Sell additional services as named add-ons.
Price per user for your security baseline
cost ÷ (1 − margin ÷ 100). Your numbers stay in the browser.
Total each client's recurring delivery costs and divide by billed users: licenses and vendor minimums, servers and devices, reporting, false positives, incident coordination, integration fixes. Price one-time deployment as a separate project.
CISA says contracts "should detail how and when MSPs notify the customer of an incident." Our managed services agreement guide shows where that clause goes.
Some duties are already yours. If you handle a healthcare client's electronic patient data as a business associate, the HIPAA Security Rule applies to you as well. Readiness work for SOC 2 or CMMC is an optional service you can sell or refer. Either way, identify the obligations with the client's compliance specialist. Assign each control to you or the client in the agreement, keep the evidence, and review it at least yearly.
A cybersecurity MSP doesn't need its own security operations center (SOC). Bring in a managed security service provider (MSSP) or a managed detection and response (MDR) provider when a client needs alerts watched around the clock. Our MSP vs MSSP guide compares them.
Before you sign, settle four questions in writing: who investigates an alert, who can isolate a device, who calls the client, and who responds after hours.
Then put the commitments in the contract: acknowledgment and containment targets, an escalation contact, reporting frequency, and which of monitoring, investigation, containment, recovery, and forensics are included. Buy penetration testing separately unless the contract names it.
How this works in SherpaDesk
Bill the baseline through a contract with recurring billing and prepaid hours; billing alerts fire as a flat-fee-plus-hourly contract or prepaid pack nears or exceeds its included hours. NinjaOne alert rules create and assign tickets. Device notification emails arrive as Alerts a tech converts to tickets.
Your helpdesk supports SSO with Active Directory, Google, or Office 365, and opt-in 2FA by app or SMS; ask every tech to turn on the app.
A helpdesk and PSA a small IT team can run alone. No contract. No implementation project. No dedicated admin.
Base Camp is $45 per agent per month ($40 billed annually). The first agent is free, forever, so a team of three on Base Camp pays $90 a month ($80 billed annually). The NinjaOne integration needs High Camp, $55 per agent per month ($50 billed annually). The trial is 14 days free with no card.
Who this isn't for
MSSPs, buyers looking for a security operations center, and anyone preparing for a HIPAA, CMMC, or SOC 2 audit: those need a specialist. You won't get threat detection or device protection from SherpaDesk. It's a helpdesk and PSA that tracks and bills the security work.
MSP stands for managed service provider, a company that runs a client's IT under an ongoing agreement. A cybersecurity MSP runs security controls such as MFA, patching, and backups. It covers the client's systems and the MSP's own tools and admin accounts.
There's no standard list of "5 C's," and versions online differ, so use a standard framework instead. NIST's Cybersecurity Framework 2.0 uses six functions: Govern, Identify, Protect, Detect, Respond, and Recover. CISA's performance goals use the same six groups, so the baseline above maps onto them.
Follow your costs. One r/msp reply: "Everything billed to you per user goes in a per user package. Everything billed to you per device goes in a per device package." Several replies in that thread priced per user, with separate lines for servers or sites.
Price from your own cost: the tools plus the labor to run them, per user per month, divided by one minus your target margin. A $40 cost at a 50% margin gives $80 per user, as the calculator above shows.
Usually not. 24/7 monitoring needs staff on every shift, which a three- or four-tech team doesn't have. Run the baseline yourself, partner with an MSSP or MDR provider for monitoring, and buy penetration tests separately. See when to bring in an MSSP.
Patrick co-founded SherpaDesk and has led it as CEO since 2013. He has worked with IT service providers since 1998, first on network projects for schools and government offices, then on the helpdesk software their technicians use every day.